GHSA-v2jf-442r-6mjh: nebula-mesh: Signed-poll nonce LRU is in-memory and bounded; replay survives restart + eviction

June 26, 2026

internal/api/pop/nonce.go:25,40,86 + internal/api/server.go:38 — the signed-poll nonce cache is an in-process LRU sized at 65,536 entries. internal/api/updates.go:31 sets pollClockSkew = 5 * time.Minute as the replay window.

References

github.com/advisories/GHSA-v2jf-442r-6mjh
github.com/juev/nebula-mesh/security/advisories/GHSA-v2jf-442r-6mjh

Code Behaviors & Features

Detect and mitigate GHSA-v2jf-442r-6mjh with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →